| Comment Number: | 531096-00068 |
| Received: | 8/4/2007 6:37:50 PM |
| Organization: | |
| Commenter: | Karl Vogel |
| State: | OH |
| Agency: | Federal Trade Commission |
| Rule: | Private Sector Use of SSNs |
| No Attachments |
Comments:
I've worked as a computer system administrator for nearly 20 years, and I've seen first-hand what type of security is in place (in both government and private-sector firms) to protect information belonging to private individuals. In a word, it's terrible. A brief look at the security breach headlines for the last few months justifies this view; if the Veteran's Administration can't handle security properly, why should I trust a private concern with an order of magnitude less oversight to do any better? If my bank or insurance company needs an ID number to keep track of my information, they can invent one. I don't trust anyone besides the SSA to handle my Social Security information, and the only reason I trust them is because I have no choice. I certainly don't see any need to provide this information to *anybody* outside the SSA; the SSN was created for one reason, and it was NOT to serve as a national ID number. I seem to recall Congress swearing up and down that my SSN would never be used in that fashion, but their assurances along those lines turned out to be worthless. I realize that combining a mobile population of ~300 million people with an enormous financial infrastructure makes personal, verifiable identification a real nightmare, but there are far better ways to handle this than the current 9-digit number system. If you examine this problem from a computer security perspective, 9 digits is less than 30 bits of information, and any $400 PC can rip through that many numbers in a few hours at most. When SSNs are at least 128 bits long, are not used as a national ID number, and are *never* re-used (yes, this is do-able), I'll be more comfortable with private sector access, because it'll be vastly more difficult to exploit them for identity theft. TECHNICAL DETAILS: generating a 128-bit identifier is easy. See http://tools.ietf.org/html/rfc4122 for a description of how it's currently done. You could generate 10 million new IDs per second and not reuse any IDs until around 3400 AD, so you never have to worry about running out or reusing an ID. Third parties don't need to store the ID as such; they can store a digital signature of that ID which would allow me to verify my identity, but would prevent anyone else from guessing or computing my ID for their own uses.